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Michael Martelle 
The National Security Archive 
Gelman Library, Suite 701 
2130 H Street, N.W. 
Washington, D.C. 20037 


Dear Mr. Martelle, 

Thank you for your September 21,2018 Freedom of Information Act (FOI A) request for the 
Joint Force Headquarters - Cyber (JFHQ-C) certification slide presentation from October 2013. 

As the initial denial authority, I am partially denying portions of the document under 5 U.S.C. §§ 
552(b)(1) and (b)(3). The denied portions include classified national security information under 
the criteria of Exeeutive Order 13526 (labeled as (b)(1)), defense critical infrastructure security 
information exempt from disclosure under 10 U.S.C. § 130e (labeled as (b)(3)), and personally 
identifying information regarding personnel assigned to a sensitive unit exempt from disclosure 
under 10 U.S.C. § 130b (also labeled as (b)(3)). U.S. Cyber Command is a sensitive unit. 

If you are not satisfied with our aetion on this request, you may file an administrative appeal 
within 90 ealendar days from the date of this letter. If you submit your appeal in writing, please 
address it to ODCMO, Director of Oversight and Compliance, 4800 Mark Center Drive, ATTN: 
l^PCLTD, FOIA Appeals, Mailbox #24, Alexandria VA 22350-1700. If you submit your appeal 
by email please send it to OSD.F01A-APPEAL@mail.mil . All correspondence should reference 
U.S. Cyber Command case tracking number 19-R019. 

You may also contact the Office of Government Information Services (OGIS), which provides 
mediation services to help resolve disputes between FOIA requesters and Federal agencies. 

OGIS may be reached at ogis@nara.gov. 202-741-5770, and 1-877-684-6448. 



Sincerely, 
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Problem Statement 


• Conduct distributed, full spectrum cyberspace operations (CO) across 4x 
JFHQ-C that are responsive to planning and execution demands of the 
Combatant Command's while providing the overwatch and visibility 
needed for USCYBERCOM. 
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Purpose, Method, Endstate 

• Purpose: To establish JFHQ-C criteria for initial and full operating 
capability (lOC/FOC). 

• Method: This brief aligns JFHQ-C mission essential tasks (METs) and 
mission critical functions (MCF) with USCYBERCOM processes currently 
used to conduct full-spectrum cyberspace operations (CO). It integrates 
tactical actions contained in SOPs and daily battle rhythm into the JFHQ- 
C METs and MCFs. This integration forms the basis to conduct individual 
training to reach IOC. Collectively, the JFHQ-C and its sub-elements 
demonstrate proficiency in these processes as part of Tier l/II exercises 
to achieve FOC. 

• Endstate: A METL-driven training program to baseline the individual 
and collective JFHQ-C readiness assessment criteria necessary to 
conduct full-spectrum, distributed CO. 
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Certification Criteria 


• Certification occurs in two parts, individual and collective. 

• Individual certification occurs upon mastery of individual training 
standards as defined by the Commander, JFHQ-C. 

• Collective certification occurs upon successful participation by the JFHQ- 
C and its sub-elements in at least two major exercises. USCYBERCOM 
evaluates the JFHQ-C and its sub-elements. 

"For the purpose of certification, subordinate commands and 
USCYBERCOM Directorates may nominate their participation in any of 
the Command's required exercises. This exercise nomination must take 
piace prior to the exercise and have a fuiiy supported assessment plan, 
both during and after the exercise event. The exercise must dearly 
demonstrate the subordinate command and directorate abilities to 
perform assigned JMETs. Additionally, analysis of Learning Management 
System entries will be used to determine training readiness of individuals 
assigned to the directorate. At least two major exercises (Tier I or II) must 
be used to determine certification." 

(Joint Cyberspace Training and Certification Standards (JCT&CS) vl,2} 
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JFHQ-C IOC Criteria 



Administrative Criteria 

Develops 

Approves 

1. 

Mission, Tasks, Functions approved 

uscc 

usee 

2. 

JFHQ-C CONOPs approved 

see 

uscc 

2.1 

Organization Design approved 

see 

uscc 

3. 

JFHQ-C METL approved 

see 

sec 

4. 

Joint Staff C2 EXORD signed 

usee 

uscc 

5. 

Key subject elements of MOA/ISSA are established 
with applicable Service Cyber Components, Services 
and NSA (MOA/ISSA not necessarily finalized). 

see 

sec css. 

Services and 
USCC 

5.1 

Team work-space allocation plan in place for IOC force 

see 

uscc 

5.2 

Operational process and relationship with NSA at 
Cryptologic Centers codified. 

sec 

sec and CSS 

5.3 

Logistics and Support processes and relationships with 
NSA, Services and Services Cyber Components are 
codified. 

see 

sec, css. 

Services and 

USCC 
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JFHQ-C IOC Criteria 


6. 

JFHQ-C possesses manning and capability for C2 of 
attached forces 

SCC 

USCC 

7. 

Individual Job Qualification Requirements are 

Developed 

USCC7SCC 

USCC/SCC 

8. 

Individuals are trained in accordance with their JQR 

SCC 

SCC 

9. 

Afunctional Watch Element* (e.g. JOC) capable of 
supporting full spectrum cyber operations is in place 

SCC 

USCC 

10. 

Afunctional 24/7 IROC** capable of supporting full 
spectrum cyber operations is in place 

SCC 

USCC 

11. 

A functional intelligence oversight program is 
established incorporating JFHQ-C as required 

SCC 

USCC 

12. 

Continuity of Operations (COOP) Procedures 
established 

SCC 

SCC 

13. 

USCC and SCC J39 operational procedures integrated 
and codified 

SCC 

USCC 

14. 

Reporting procedures, to include operational and 
administrative missions 

SCC 

SCC 
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A Building Block Approach to lOC/FOC 



Gdllectiye Traihih^ 
Sub-rEiehnent Level 





■ I d dividu a I 


• Tier I/M Exercises 

« 


• Mission Rehearsal Exercise 

• JFHQ-C training 


[b)(1) Sec, 1.7(e) 


• Sub-Element Validation 
Events (SEV) 

• Cyber Flag 


, (bKI)Sec. 1.7(e} 


Branch/Division training 
Team/Section training 


• Individual qualification 

• OJT 

• Individual training pipeline 

• Formal initial training 
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Section 2: 

JFHQ-C Mission Essential Tasks 
& Mission Critical Functions 
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JFHQ-CMETand MCF 


Background Information 


• In March, 2013, USCYBERCOM established a working 
group to develop the Mission Essential Tasks and 
subsequent Mission Critical Functions for the JFHQ- 
C. The WG performed a detailed scrub of the Universal 
Joint Task List (UJTL) identifying all UJTL entries that were 
listed under "Joint Task Force" and debated within the 
WG on which JTF UJTLs were most relevant to the JFHQ- 
C. The following METs and MCFs were reviewed and 
approved by USCYBERCOM J3 in June, 2013. 


VenX J^CodeAO 
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JFHQ-C Mission Essential Task List (METL) 

1. Exercise C2 of all attached CMF ISO CCMD mission, 

2. Exercise SIGINT Authority, Mission Delegation and Intelligence Oversight (to 
include SIGINT 10 and auditing) of all attached CMF ISO CCMD mission. 

3. Plan and direct Cyber ISR, Cyber OPE, Cyber Attack and - when directed - Cyber 
Defense actions to accomplish CCMD specified missions, and BPT conduct crisis 
action planning and CO in response to global threats. 

4. Coordinate, integrate, synchronize and de-conflict CO of attached CMF with 
other JFHQ-C, NMF-HQ and USCC, operating in the same networks, at the 
tactical level, to maximize operational effectiveness. Coordinate as required with 
NSA Cryptologic Center Commanders. 

5. Conduct intelligence operations; including managing CMF intelligence 
requirements and the collection, production and dissemination of intelligence. 

6. Coordinate JFHQ-C support functions for attached and for co-located CMF with 
USCC, NSA, service and functional components; direct CMF training, exercises, 
and readiness requirements. 


JFHQ-C Mission Essential Tasks and Functions Brief dtd 21JUN13 
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JFHQ-C MET 1 and MCFs 


• MET 1: Exercise C2 of all attached CMF ISO CCMD mission. Command and 
Control Joint Force Headquarters - Cyber 

• Mission Critical Functions (MCF) 

1.1 Exercise Command and Control of CMF maneuver teams 

1.2 Report Readiness 

1.3 Provide for Legal Services ISO planning & operations, except that all operational 

SIGINT legal advice will be provided by NSA OGC 

1.4 Maintain Operational Information and Force Status (Also supports Tasks 2-5) 

1.5 Conduct Joint Force Staff Operations 

1.6 Conduct operational synchronization and integration with JCC/JFCCC 

1.7 Conduct Knowledge Management and Information Management 
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JFHQ-C MET 2 and MCFs 

• MET 2: Exercise SIGINT Authority, Mission Delegation and Intelligence Oversight 
(to include SIGINT 10 and auditing) of all attached CMF ISO CCMD mission. 

• Mission Critical Functions (MCF) 

2.1 Manage the SIGINT collection process 

2.2 Conduct asset management 

2.3 Manage mission delegation 

2.4 Oversee CMF Cryptologic Intelligence Oversight (CIO) program 

2.5 Provide advice and guidance on SIGINT policy and procedures 

2.6 Provide Operations & Intelligence system support 
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JFHQ-CMET3and MCFs 


• MET 3: Plan and direct Cyber ISR, Cyber OPE^ Cyber Attack and - when directed 
- Cyber Defense actions to accomplish CCMD specified missions, and BPT 
conduct crisis action planning and CO in response to global threats. 

• Mission Critical Functions (MCF) 

3.1 Prepare Plans and Orders 

3.2 Conduct Mission Analysis 

3.3 Issue Planning Guidance 

3.4 Develop COA/Prepare staff estimates 

3.5 Issue Commander's Estimate 

3.6 Issue Plans and Orders 

3.7 Coordinate battlespace maneuver & integrate with firepower 

3.8 Support Target System Analysis, Electronic Target Folders and Target List 
Production/Management 
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^ JFHQ-C MET 3 and MCFs (Cont.) 

• MET 3: Plan and direct Cyber ISR, Cyber OPE, Cyber Attack and - when directed 
- Cyber Defense actions to accomplish CCMD specified missions, and BPT 
conduct crisis action planning and CO in response to global threats. 

• Mission Critical Functions (MCF) 

3.9 Support HPT/HVT development 

3.10 Conduct operational rehearsals 

3.11 Conduct operational maneuver 

3.12 Conduct effects and tactical assessments 

3.13 Prioritize OPE and ISR efforts 

3.14 Conduct dynamic targeting 

3.15 Participate in Task Forces (Joint/interagency/international) 

3.16 Conduct Computer Network Exploitation (CNE) enabling operations (Cyberspace ISR 
and Cyberspace OPE) 
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JFHQ-CMET4and MCFs 


• MET 4: Coordinate, integrate, synchronize and de-conflict CO of attached CMF 
with other JFHQ-C, NMF-FIQ. and USCC, operating in the same networks, at the 
tactical level, to maximize operational effectiveness. Coordinate as required with 
NSA Cryptologic Center Commanders. 

• Mission Critical Functions (MCF) 

4.1 Synchronize, deconflict, and integrate operations/fires 

4.2 Coordinate employment of CO 

4.3 Manage use and assignment of terrain 

4.4 Synchronize and integrate operations 

4.5 Conduct Operational Assessment 

4.6 Employ tactical cyberspace firepower 

4.7 Coordinate and integrate joint/multinational and lA support 

4.8 Coordinate with cryptologic enterprise elements (NSA) 
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JFHQ-CMET5and MCFs 


• MET 5: Conduct intelligence operations; including managing CMF Intelligence 
requirements and the collection, production and dissemination of intelligence. 

• Mission Critical Functions (MCF): 

5.1 Process and exploit collected operational information 

5.2 Direct Joint Intelligence Support Element (JISE) operations 

5.3 Perform Collection Management (Planning & Prioritization, Requirements 
Management, & Tasking Cyber ISR Assets) 

5.4 Conduct Intelligence Preparation of the Battlespace (IPB) 

5.5 Gain & Maintain Situational Understanding 

5.6 Provide Intelligence Support to Plans, Operations, and Fires 

5.7 Develop Operational Targets 

5.8 Conduct Cyberspace ISR 

5.9 Conduct Single Source Exploitation 

5.10 Provide SIGINT on Specified Targets 

5.11 Produce Operational Intelligence 

5.12 Conduct Intelligence Staff Operations 
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I# JFHQ-C MET 6 and MCFs 

• Coordinate JFHQ~C support functions for attached or co-located CMF with USCC, 
NSA, service and functional components; direct CMF training, exercises, and 
readiness requirements. 

• Mission Critical Functions (MCF); 

6.1 Plan, Direct, and Execute Exercises 

6.2 Provide Resource Managennent 

6.3 Serve as the USCC Coordinating Authority facilitating as required. Service 
Component ADCON through local coordination of admin, logistics & support 
requirements for all co-located (attached and unattached) CMF 

6.4 Serve as the USCC Coordinating Authority to coordinate and deconflict deliberate 
mission scheduling for unattached, co-located CMF 

6.5 Serve as the USCC Coordinating Authority to coordinate and deconflict time 
sensitive operations for unattached, co-located CMF 

6.6 Prioritize Architecture and Capabilities Development and Requirements (ISO Task 4) 

6.7 Coordinate Logistic Services 

6.8 Manage Personnel Accountability & Strength Reporting 

6.9 Provide Security (ACCM) Management & oversee STO/SAP operations 

6.10 Conduct Joint Force Staff Operations 

6.11 Conduct command designated coordination operations 

6.12 Coordinate and direct weapon capability development 
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Section 3: 

USCYBERCOM Processes 
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USCYBERCOM Processes 

The following are the processes, B2C2WG and tactical actions that USCYBERCOM 
uses to conduct full spectrunn CO. 

Processes 

PI Cyberspace Tasking Cycle {Modified Air Tasking Cycle) 

- Cyberspace Operations Directive (CyOD) 

— Master Cyber Operations Plan (MCOP) 

- integrated Tasking Order (ITO) 

“ Special Instructions (SPINs) 

“ Joint Tactical Cyber Request (JTCR) 

- Assessment (MISREPs, BDA/MEA/Re-strike/Re-target) 

P2 Cyberspace Effects Request Form (CERF) 

P3 


[bK3)10U,S.C. §130e 


P4 Planning Teams 
P5 Operational Priorities and Intelligence Collection Priorities 
P6 Joint Targeting Cycle 

- Target Development: TDWG/JTWG 
“ Strike Package Coordination: JTCM 
“ Target Validation/Approval: JTCB 
P7 Operations Synchronization 
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USCYBERCOM Process 1 and ITs 


• PI: Cyberspace Tasking Cycle 

• The Cyberspace Tasking Cycle is a modified air tasking cycle. It provides for effective 
and efficient employment of Joint forces and capabilities. It is an iterative, cyclic is a 
six step process to plan, schedule, execute, and assess full-spectrum cyberspace 
operations. 


Individual Tasks (ITs) 

1.1 Objectives, Effects, and Guidance (CyOD) 

1.2 Target Development and Weaponeering (Joint Targeting Process) 

1.3 Allocation (MCOP, JTCR) 

1.4 ITO Production and Dissemination' 


fb){3) 10 U.S C. § 130e 


1.5 Execution Planning and Force Execution (SPINs) 

1.6 Assessment 


• MISREP 

• MOP/MOE 

• Combat Assessment Process (BDA, MEA, and Re-strike/Re-target) 
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Cyberspace Tasking Cycle 
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USCYBERCOM Process 2 and ITs 

• P2: Cyberspace Effects Request Form (CERF): 

• A CERF is a formal request for USCYBERCOM operational support. It is the form 
USCYBERCOM uses to receive, track, and provide operational effects in support of 
planning and execution across all lines of operations: offensive cyberspace operations 
(OCO), defensive cyberspace operations (DCO), and DOD global information grid 
operations (DGO). 

• Individual Tasks (ITs): 

2.1 Links the desired effects with the tactical objective, operational goal and strategic 
endstate 

2.2 Records, tracks, and manages requests from the supported JFC 

2.3 Assigned to planning team lAW time horizon and function 

2.4 Facilitates dialogue/DIRLAUTH and transparency throughout the process 

2.5 Automated status of planning tracker 
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Cyberspace Tasking Cycle 
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USCYBERCOM Process 3 and ITs 
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1^ USCYBERCOM Process 3 and ITs (Cont.) 



• Individual Tasks (ITs): 



UNCLASSIFIED / /fOn Orr i CtAL -4JS E ONL -V 


27 






UNCLASSIFIED / / F O R O FF IC I AL USE ' ONL - V 



Cyberspace Tasking Cycle 



MCiOP 


Target Lists 


Strike Package 


MISREPS 


JTGR 


SPINS 


Objectives, Effects 
and Guidance 


Assessment 


Development and 
Weaponeering ^ 


Execution Planning 
and Force Execution 


JFHQ'.iC’" 


LEGEND 

CERF - Cyber Effects Request Fonn MCOP - Master Cyber Operations Plan 

CYOD - Cyber Operations Directive ITO - Integrated Tasking Order 

JTCR - Joint Tactical Cyber Request CCO - Cyber Control Order 
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USCYBERCOM 


Process 4 and ITs 


• P4: Planning Teams 

“ 'Vlanning translates strategic guidance and direction into campaign plans^ 

contingency plans, and operations orders (OPORDs), Joint operation planning may be 
based on defined tasks identified in the Guidance for Employment of the Force (GEF) 
and the Joint Strategic Capabilities Plan (JSCP). Alternatively, joint operation planning 
may be based on the need for a military response to on unforeseen current event, 
emergency, or time-sensitive crisis/' (JP 5-0) 

• Individual Tasks (ITs) 

4.1 Strategy Division/Future Operations Team (J35) 

• Base OPORD/EXORD 

• Branches and sequel planning 

• Propose changes to ROE and Rules for Use Of Force (ROF) 

• Develop and coordinate the CyOD 

• Operational assessment reports and plans 
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USCYBERCOM Process 4 and ITs (Cont.) 

• P4: Planning Teams 

- "Planning translates strategic guidance and direction into campaign plans, 

contingency plans, and operations orders (OPORDs), Joint operation planning may be 
based on defined tasks identified in the Guidance for Employment of the Force (GEF) 
and the Joint Strategic Capabilities Plan (J5CP). Alternatively, Joint operation planning 
may be based on the need for a military response to an unforeseen current event, 
emergency, or time-sensitive crisis." (JP 5-0) 

• Individual Tasks (ITs) 

4.2 Combat Plans/Joint Fires Element (J38) 

• Conduct Crisis Action Planning 

• Produce MCOP 

• Process/generate JTCRs 

• Produce ITO 

• Generate SPINs 

• Conduct combat assessments 

• Conduct advanced target development (Weaponeering) 

• Produce the draft JIPTL 

• Build and coordinate Strike Package 

• Manage Target Lists 
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USCYBERCOM Process 4 and ITs (Cont.) 

• P4; Planning Teams 

- "Planning translates strategic guidance and direction into campaign plans, 

contingency plans, and operations orders (OPORDs), Joint operation planning may be 
based on defined tasks identified in the Guidance for Employment of the Force (GEE) 
and the Joint Strategic Capabilities Plan (JSCP). Alternatively, joint operation planning 
may be based on the need for a military response to on unforeseen current event, 
emergency, or time-sensitive crisis" (JP 5-0) 

• Individual Tasks (ITs) 

4.3 Current Operations (J33) 

• Provide constant monitoring and support of missions 

• Publish changes to ITO as necessary in response to changes in operations and/or 
the operating environment 

• Develop reports as required 

• Manage common tactical/operational picture 

• Conduct dynamic targeting 

• Provide real time intelligence 
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Cyberspace Tasking Cycle 



Brartches S^Sedtiels 


mi.U.MJJI.I: 




BDA. MEA ^ 
Re-strike/Retarqet 




MISREPS 


mm 


mmm 

<' _ .. 


Objectives. Effects 
and Guidance 


^Execution Planning 
and Force Execution 


LEGEND 

CERF - Cyber Effects Request Form MCOP - Master Cyber Operations Plan 

CYOD - Cyber Operations Directive ITO - Integrated Tasking Order 

JTCR - Joint Tactical Cyber Request CCO - Cyber Control Order 
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USCYBERCOM Process 5 and ITs 


• P5: Operational Priorities and Intelligence Collection Priorities 

• The priorities process allows the Commander to shift his main and supporting efforts 
by periodically assessing operational priorities within three mission areas (Defend the 
Nation, Operate and Defend the DODIN, and Support to Combatant Commanders). 
The process aligns intelligence collection efforts with operational priorities. 

• Individual Tasks (ITs): 

5.1 Priorities Working Group (PWG) - Analyzes demand signal from CERFs and command 
guidance against current operational and planning priorities. Creates proposed 
operational planning priorities for approval by DCDR via J2/J3/J5 review. 

5.2 Collection Management Working Group (CMWG) 

• Reviews and prioritizes Joint Integrated Prioritized Collection List (JIPCL) - 
intelligence, access, capability, and interagency requirements 

• Develops intelligence collection guidance and priorities for ISR forces 

• Provides status of collection actions and evaluates effectiveness of collection 

• Deconflicts Command/Service Cyber Component (SCC) requirements 
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Cyberspace Tasking Cycle 



Assessment 


Developmentand 
Weaponeering , 


Execution Planning 
and Force Execution 


Allocation 


LEGEND 

CERF - Cyber Effects Request Form MCOP » Master Cyber Operations Plan 

CYOD - Cyber Operations Directive ITO - Integrated Tasking Order 

JTCR - Joint Tactical Cyber Request CCO ~ Cyber Control Order 


KEY 

SOPs 

Battle Rhythm (B2C2WG) 


PWG 

CMWG 
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• P6: Joint Targeting Cycle 

• "Targeting is the process of selecting and prioritizing targets, matching the 
appropriate response to them, and considering operational requirements and 
capabilities/' (JP 3-60) Integrating and synchronizing planning, execution, and 
assessment is pivotal to the success of targeting. 

• Individual Tasks (ITs) 

6.1 Target Development Working Group (TDWG) — Responsible developing targets 
through the basic through intermediate development process and produces a vetted 
target ready for advanced development. The focus of the TDWG is target status to 
properly vet the target. 

6.2 Joint Targeting Working Group (JTWG) - Responsible for approving entities for target 
development and providing the status of advanced targets; ultimately producing a 
target strike package to the JTCM for coordination. The focus of the JTWG is to ensure 
fires and effects delivered in and through cyberspace support the objective(s). 
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USCYBERCOM Process 6 and ITs (Cont.) 

• P6: Joint Targeting Cycle 

• "Targeting is the process of selecting and prioritizing targets, matching the 
appropriate response to them, and considering operational requirements and 
capabilities" (JP 3-60) Integrating and synchronizing planning, execution, and 
assessnnent is pivotal to the success of targeting. 

• Individual Tasks (ITs) 

6.3 Cyberspace Strike Package - The primary product presented to the chairman of the 
JTCB for the purpose of informing the Commander's decision regarding the execution 
of an operation. The Cyberspace Strike Package includes: 

• Concept of Fires/Effects 

• Intel Gain Loss (IGL) 

• Political Military Assessment (PMA) 

• Collateral Effects Estimate (CEE) 

• Operation Legal Review (OLR) 

• Blowback Assessment 

• No Foreign Policy Objection (NFPO) 

• Risk Assessment Report (RAR)/Capability Target Pairing (CTP) 
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USCYBERCOM Process 6 and ITs (Cont.) 

• P6: Joint Targeting Cycle 

• "Targeting is the process of selecting and prioritizing targets, matching the 
appropriate response to them, and considering operational requirements and 
capabilities" (JP 3-60) Integrating and synchronizing planning, execution, and 
assessment is pivotal to the success of targeting. 

• Individual Tasks (ITs) 

6.4 Target Validation 

• Joint Targeting Coordination Board (JTCB) - On behalf of the supported or 
supporting JFC, develop broad targeting priorities and other targeting guidance in 
accordance with the JFC"s objectives as they relate operationally. 
Approve/Disapprove addition of targets to USCC target lists or target, capability 
and concept of fires release to COCOM. 

• The JTCB validates a target in context of the plan or operation order it supports. 
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Cyberspace Tasking Cycle 
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USCYBERCOM Process 7 and ITs 

• P7: Operations Synchronization 

• The Operations Synchronization (OPS-SYNC) meeting assesses operations executed 
during the last 24-hours; evaluates ongoing operations for the present day ITO and 
schedules and deconflicts operations out to 48-hours and beyond by annotating them 
on a MCOP. The current intelligence picture, collection emphasis message, target 
status, and readiness of forces and infrastructure inform this effort. 

• Individual Tasks (ITs) 

7.1 Deconflicting CO throughout the domain 

7.2 Synchronizing CO with other kinetic or non-kinetic operations 

7.3 Providing updates/support to efforts spanning all phases of the Cyberspace Tasking 
Cycle 

7.4 Integrating legal services in support of planning and operations 
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1 ^ Integration of METs/MCFs with USCYBERCOM 
processes 

• The following slides outline how the major USCYBERCOM process integrate with 
the METs/MCFs of the JFHQ. It nests individual tasks under mission critical 
functions that support the mission essential tasks to show how the processes 
employed by USCYBERCOM support each of the tasks that the JFHQ-C will 
required to accomplish. 
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JFHQ-C MET 1 and MCFs Integrated with 
USCYBERCOM Processes 

MET 1: Exercise C2 of all attached CMF ISO CCMD mission. Command and 
Control Joint Force Headquarters - Cyber. 

Mission Critical Functions (MCF) 

1.1 Exercise Command and Control of CMF maneuver teams 



• P7 OPS-SYNCH: 

IT 7.1 Deconflicting CO throughout the domain (Ref TA 3.3 Coordinate 
Battlespace Maneuver and Integrate with Firepower) 

IT 7.2 Synchronizing CO with other lethal or non-lethal operations (Ref TA 
3.3) 

1.2 Report Readiness 



1.3 Provide for Legal Services ISO planning & operations, except that a I operational 
SI6INT legal advice will be provided by NSA OGC 

• P7 OPS-SYNCH: IT 7.4 Integrating legal services in support of planning and 
operations (Ref OP 4.4.7 Provide for legal services) 
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JFHQ-C MET 1 and MCFs Integrated with 
USCYBERCOM Processes (Cont.) 


1.4 Maint ain Operatio nal Information and Force Status (Also supports Tasks 2-5) 

^ P2|b)(3)10U.S.C.§130e “ -- 


(b)(3) 10 U,S.C.§130e 


• P7 OPS-SYNCH: IT 7.3 Providing updates/support to efforts spanning all phases of 
the Cyberspace Tasking Cycle 

1.5 Conduct Joint Force Staff Operations 

• PI Cyberspace Tasking Cycle: Outlines the steps and processes necessary to 


conduct CO 


• P4 Planning Teams: Properly organized teams following the Cyberspace Tasking 
Cycle will accomplish the staff actions needed to successfully employ CO 

1.6 Conduct operational synchronization and integration with JCC/JFCCC 

• P3 


. P7 


[b)(3)10U.S.C. §130e 


OPS-SYNCH : 


IT 7.1 Synchronizing and Deconflicting CO throughout the domain (Ref TA 
5.5.1 Conduct Force Link Up, TA 5.6.5.1 Coordinate employment of 
Computer Network Operations in Joint Operations Area) 

IT 7.3 Forum to discuss status of l&W and operations assessments (Ref TA 2.4 
Discuss Tactical Warning Information and Attack Assessment) 
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JFHQ-C MET 1 and MCFs Integrated with 
USCYBERCOM Processes (Cont.) 


1.7 Conduct Knowledge Management and Information Management 



P7 OPS-SYNCH : 

IT 7.1 Deconflict CO with the 1C and adjacent units (Ref TA 5.6.5.1 Coordinate 
employment of Computer Network Operations in a Joint Operations Area) 

IT 7.3 Share Operational Intelligence 
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JFHQ-C MET 2 and MCFs 
USCYBERCOM Processes 


UNCLASSIFIED / /FOR OFFICIAL USE ONL Y 

Integrated with 


• MET 2: Exercise SIGINT Authority, Mission Delegation and Intelligence Oversight 
(to include SIGINT 10 and auditing) of all attached CMF ISO CCMD mission. 




Mission Critical Functions (MCF) 

2.1 Manage the SIGINT collection process 

• IT 5.1 PWG: Creates operational planning priorities that informs the intelligence 
collection priorities 

• IT 5.2 CMWG: Prioritizes the JIPCL and develops collection guidance and priorities 
for ISR forces 


2.2 Conduct asset management 



2.3 Manage mission delegation 



• IT 5.2 CMWG: Prioritizes the JIPCL and develops collection guidance and priorities 
for ISR forces 
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JFHQ-C MET 2 and MCFs Integrated with 
USCYBERCOM Processes 


2.4 Oversee CMF Cryptologic Intelligence Oversight (CIO) program 

1(b)(3) 10 U.S.C. § 130e 


P3 


(b)(3) 10 U.S.C. § 130e 


2.5 Provide advice and guidance on SIGINT policy and procedures 

• P7 OPS-SYNCH: IT 7.4 Integrating legal services in support of planning and 
operations (Ref OP 4.4.7 Provide for legal services) 

2.6 Provide Operations & Intelligence system support_ 
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I JFHQ-CMET3andMCFs 



• MET 3: Plan and direct Cyber ISR, Cyber OPE, Cyber Attack and - when directed - 
Cyber Defense actions to accomplish CCMD specified missions, and BPT conduct 
crisis action planning and CO in response to global threats. 

• Mission Critical Functions (MCF) 

3.1 Prepare Plans and Orders 

• PI Cyberspace Tasking Cycle: IT 1.4 ITO production and dissemination (Ref OP 5.3 
Prepare Plans and Orders, OP 5.4.1 Approve Plans and Orders, TA 3.3.1 Prepare the 
Air Tasking Order) 

• P2 CERF: IT 2.3 Initiates operational planning (Ref TA 5.6.5.1 Coordinate 
Employment of Cyberspace operations) 



j(b)(3) 10 U.S.C. § 130e 


10 U.S.C, § 130e 


• P4 Planning Teams: IT 4.2 Prepare the ITO, MCOP, JIPTL, and SPlNs (Ref TA 3.3.1 
Coordinate Air Tasking Order) 

3.2 Conduct Mission Analysis 

• P4 Planning Teams: IT 4.1 Conduct Branch and Sequel planning lAW the Joint 
Operation Planning Process (JOPP) outlined in JP 5-0 
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^ JFHQ-C MET 3 and MCFs (Cont.) 

3.3 Issue Planning Guidance 

• PI Cyberspace Tasking Cycle: IT 1.1 Objectives, Effects, and Commander's guidance 
is disseminated to the JFHQ staff via the CyOD (Ref TA 5.6.5.1 Coordinate 
Employment of Cyberspace Operations) 

• P2 CERF: IT 2.1 Conveys Commander's objectives, end state and desired effects to 
the planning teams (Ref TA 5.6.5.1 Coordinate Employment of Cyberspace 
Operations) 

3.4 Develop COA/Prepare staff estimates 

• P4 Planning Teams: IT 4.1 Conduct planning lAW the JOPP outlined in JP 5-0 

3.5 Issue Commander's Estimate 

• P4 Planning Teams: IT 4.1 Conduct planning lAW the JOPP outlined in JP 5-0 

3.6 Issue Plans and Orders 


• PI Cyberspace Tasking Cycle: IT 1.4 ITO Production and Dissemination (Ref 
OP 5.3 Prepare Plans and Orders, OP 5.4.1 Approve Plans and Orders, 

TA 3.3.1 Prepare the Air Tasking Order)_ 


P3 

(b)(3) 10 U.S.C. § 130e 

:b)(3) K 

3 U.S.C. § 130e 



• P4 Planning Teams: IT 4.2 Prepare the ITO, MCOP, JIPTL, and SPINs (Ref TA 3.3.1 
Coordinate Air Tasking Order) 
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JFHQ-C MET 3 and MCFs (Cent.) 

3.7 Coordinate Battlespace maneuver & integrate with firepower 
• PI Cyberspace Tasking Cycle: 

IT 1.3 Allocation 



3.8 


• P3 


IT 1.4 Iterative, Cyclic process to plan, schedule and execute CO {Ref OP 3.1.2 
Apportion fires, OP 5.3 Prepare Plans and Orders, OP 5.4.1 Approve Plans 
and Orders, TA 3.3.1 Prepare the Air Tasking Order) 

(b)(3) 10 U.S.C.§130e ~--- 


• P7 OPS-SYNC: IT 7.1 Deconflict operations with the 1C and adjacent units (Ref TA 
5.6.5.1 Coordinate Employment of Cyberspace Operations) 

Support Target System Analysis, Electronic Target Folders and Target List 
Production/Management 


• PI Joint Targeting Cycle: IT 1.1, IT 1.2 Develop Targets through the advanced level 
and place them on a targeting list (Ref OP 2.8 Provide Intelligence Support to Fires, 
TA 2.1 Produce Electronic Target Folders) 

• P4 Planning Teams: IT 4.1 Submit intelligence requirements and requests for 
information as required to build a Target System Analysis (Ref OP 2.8 Provide 
Intelligence Support to Fires) 
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^ JFHQ-C MET 3 and MCFs (Cent.) 

3.9 Support HPT/HVT development 

• P4 Planning Teams: 

IT 4.1 Submit intelligence requirements and requests for information as 
required to build a Target System Analysis (Ref OP 2.8 Provide Intelligence 
Support to Fires) 

IT 4.2 Prioritize HPTs/HVTs 

• P6 Joint Targeting Cycle: IT 6.3 Prepare cyberspace strike package for Commander's 
approval 

3.10 Conduct operational rehearsals 

• P4 Planning Teams: IT 4.1, IT 4.2 Identify and rehearse key processes and elements 

3.11 Conduct operational maneuver 

• PI Cyberspace Tasking Cycle: 

IT 1.3 Translate JTCR onto the MCOP 
IT 1.4 Produce ITOs from the MCOP 
IT 1.5 Generate SPINs 

• P7 OPS-SYNC: IT 7.1 Deconflict operations with the 1C and adjacent units (TA 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 
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JFHQ-C MET 3 and MCFs (Cont.) 


3.12 Conduct effects and tactical assessments 

• PI Cyberspace Tasking Cycle: IT 1.6 Assessment (MISREPS, MOP/MOE, BDA) 

• P3 


[bK3)10U.S,C, §130e 


• P4 Planning Teams: IT 4.1 Digest MISREPs and intelligence reports and produce 
effects and tactical assessments 


• P7 OPS-SYNC: IT 7.3 Disseminate assessment information (Ref TA 2.4 Disseminate 
Tactical Warning Information and Attack Assessments) 

3.13 Prioritize OPE and ISR efforts 


• PI 


• P3 


• P4 

IT 4.1 Provide characterization of the cyberspace battlespace (Ref TA 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 4.3 Identify cyberspace activity as neutral, friendly, or adversarial (Ref TA 6.5 
Provide for Combat Identification) 

• IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR forces 


Cyberspace Tasking Cycle: 

IT 1.1 Objectives, Effects, and Guidance 
IT 1.3 Allocation 

;ti)(3)10U.S,C. §130e 


Planning Teams: 
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JFHQ-C MET 3 and MCFs (Cent.) 


3.14 Conduct dynamic targeting 

• P4 Planning Teams: IT 4.2 Conduct planning/crisis action planning and produce 
cyberspace strike packages as required to support dynamic targeting 

• P6 Joint Targeting Cycle: IT 6.4 Validate targets at the JTCB and place them on a 
targeting list to be prosecuted as targets of opportunity 

3.15 Participate in Task Forces (Joint/Interagency/International) 

• P2 CERF: TA 2.4 Facilitates dialogue/DIRLAUTH and transparency throughout the 
process (Ref TA 5.6.5.1 Coordinate Employment of Cyberspace Operations 

3.16 Conduct Computer Network Exploitation (CNE) enabling operations (Cyberspace !SR 
and Cyberspace OPE) 

PI Cyberspace Tasking Cycle: Iterative, Cyclic process for planning, scheduling, 
executing and assessing OPE and ISR missions 
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JFHQ-CMET4and MCFs 


• MET 4: Coordinate, integrate, synchronize, and de-conflict cyber operations of 
attached CMF with other JFHQ-C, NMF-HQ and USCC, operating in the same 
networks, at the tactical level, to maximize operational effectiveness. Coordinate 
as required with NSA Cryptologic Center Commanders. 


• Mission Critical Functions (MCF) 

4.1 Synchronize, deconflict, and integrate operations/fires 
• PI Cyberspace Tasking Cycle: 

IT 1.3 Allocation (MCOP) 

IT 1.4 ITO Production and Dissemination (Ref TA 5.6.5.1 Coordinate 


• P3 


• P7 


employment of Computer Network Operations in a Joint Operations Area) 

(b)(3) 10 U.S.C.§130e “ - 


OPS-SYNC: 


IT 7.1 Deconflict CO throughout the domain (Ref TA 3.3 Coordinate 
Battlespace Maneuver and Integrate with Firepower) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 7.3 Disseminate l&W information (Ref TA 2.4 Disseminate Tactical Warning 
Information and Attack Assessments) 
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JFHQ-C MET 4 and MCFs 


4.2 Coordinate employment of Cyberspace Operations (CO) 

• PI Cyberspace Tasking Cycle: Iterative process that outlines the procedures 
necessary for conducting CO (Ref TA 5.6.5.1 Coordinate employment of Computer 
Ne twork Operations in a Joint Operations Area) 



P4 Planning Teams: IT 4.2, IT 4.3 Identify and rehearse key processes and 
elements 


• P7 0PS-SYNC: 

IT 7.1, IT 7.2 Deconflict and synchronize CO with the 1C and adjacent units 
(Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3,3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 7.3 Disseminate l&W information (Ref TA 2.4 Disseminate Tactical Warning 
Information and Attack Assessments) 
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JFHQ-CMET4and MCFs 


4.3 


Manage use and assignment of terrain 
• PI Cyberspace Tasking Cycle: 

IT 1.3 Allocation - Systematically assign forces to battlespace areas (Ref Op 
3.1,2 Apportion Fires) 


IT 1.3 Allocation - Establish primacy on cyberspace assets/devices (Ref TA 6.5 
Provide for Combat Identification) 



IT 5.2 CMWG: Develop collection guidance and priorities for ISR forces 
P7 0PS-SYNC: 


IT 7.1 Deconflict and synchronize CO with the 1C and adjacent units (Ref TA 
3.3 Coordinate Battlespace Maneuver and Integrate with Firepower, TA 
5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 
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JFHQ-C MET 4 and MCFs 



4.4 


Synchronize and integrate operations 

, Kb)(3) 10U.S.C. § 130e 


• P7 OPS-SYNC: 

IT 7.1 Deconflict and synchronize CO with the 1C and adjacent units (Ref TA 
3.3 Coordinate Battlespace Maneuver and Integrate with Firepower, TA 
5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 7.3 Identify cyberspace activity as neutral, friendly, or adversarial (Ref TA 
6.5 Provide for Combat Identification) 


4.5 


Conduct Operational Assessment 
• PI Cyberspace Tasking Cycle: IT 1.6 Assessment 


(b)(3) 10U.S.C. § 130e 


P3, 

P4 Planning Teams: IT 4.1 Digest MISREPsand intelligence reports and produce 
effects and tactical assessments 

P7 OPS-SYNC: IT 7.3 Disseminate assessment information (Ref TA 2.4 Disseminate 
Tactical Warning Information and Attack Assessments) 
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JFHQ-CMET4and MCFs 

4.6 Employ tactical cyberspace firepower 

• PI Cyberspace Tasking Cycle: IT 1.5 Execution Planning and Force Execution (Ref 
OP 5.3 Prepare Plans and Orders, OP 5.4.1 Approve Plans and Orders, TA 3.3.1 
Prepare the Air Tasking Order) 

• P3 


• P7 

IT 7.1 Deconflict and synchronize CO with the 1C and adjacent units (Ref TA 
3.3 Coordinate Battlespace Maneuver and Integrate with Firepower, TA 
5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower, TA 3.2.3 
Conduct Interdiction) 


[b)(3)10U.S.C.§130e 


OPS-SYNC: 
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^ JFHQ-C MET 4 and MCFs 

4.7 Coordinate and integrate Joint/Multinational and Interagency support 

• P4 Planning Teams: IT 4.1 Conduct planning lAW the Joint Operational Planning 
Process (JOPP) outlined in JP 5-0 and coordinate with Joint/Multinational forces 
and the Interagency as required to deconflict plans 

• P6 Joint Targeting Cycle: 

IT 6.1 Develop targets and Vet them with the Interagency lAW CJCSI 3370.01 
IT 6.4 Validate targets and cyberspace strike package at the JTCB lAW CJCS! 
3370.01 

• P7 OPS-SYNC: 

IT 7.1 Deconflict and synchronize CO with the 1C and adjacent units (Ref TA 
3.3 Coordinate Battlespace Maneuver and Integrate with Firepower, TA 
5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower, TA 3.2.3 
Conduct Interdiction) 


UNCLASSIFIED / /FOR OF F IC I AL US E ONLV 


60 




UNCLASSIFIED / /TOR O F F I C I AL USE ONl ^f 



JFHQ-C MET 6 and MCFs 


6.10 Conduct Joint Force Staff Operations (Cont.) 

• P6 Joint Targeting Cycle 

IT 6.1 TDWG: Develop targets through the intermediate stage and vet them 
with the 1C 

IT 6.2 JTWG: Nominate and approve entities of interest for target 
development, and conduct advanced target development of vetted targets 

IT 6.3 Build cyberspace strike package to present at JTCM & JTCB 

IT 6.4 JTCB: Approve the target and cyberspace strike package for tactical 
engagement and place on JIPTL 

• P7 OPS-SYNC: 

IT 7.1, IT 7.2 Deconflict and synchronize CO with the 1C and adjacent units 
(Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 7.3 Providing updates/support to efforts spanning all phases of the 
Cyberspace Tasking Cycle 

IT 7.4 Integrating legal services In support of planning and operations (Ref OP 
4.4.7 Provide for legal services) 
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JFHQ-C MET 6 and MCFs 


6,10 Conduct Joint Force Staff Operations 

• PI Cyberspace Tasking Cycle; Iterative, Cyclic process that allows staff officers to 
plan, execute, and assess CO_ 



• P4 Planning Teams: Properly organized teams following the Cyberspace Tasking 
Cycle will accomplish the staff actions needed to successfully employ CO 

• P5 Operational Priorities and Intelligence Collection Priorities: 

IT 5.1 PWG: Analyze demand signal from CERFs and command guidance 
against current and operational planning priorities 
IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 

IT 5.2 CMWG: Deconflict Command/SCC requirements 
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JFHQ-CMET6and MCFs 


6.9 Provide Security (ACCM) Management & oversee STO/SAP operations 


• P4 Planning Teams: 


IT 4.1 Establish ACCM management program 

IT 4.2 Submit JTCRs to add STO/SAP missions to the MCOP and ITO (Ref TA 
5.6.5.1 Coordinate Employment of Cyberspace Operations) 
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JFHQ-C MET 6 and MCFs 


6.7 Coordinate Logistic Services 


• P3 

(bj(3)10U.S.C. §130e 


• P4 Planning Teanns: IT 4.1 Coordinate with USCC as required for logistic support 
(Ref TA 4 Perform Logistics and Combat Service Support, TA 4.2 Provide 
Sustainment) 

6.8 Manage Personnel Accountability & Strength Reporting 

• P3 

(b)(3) 10 U.S.C. § 130e 
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JFHQ-C MET 6 and MCFs 


6.4 Serve as the USCC Coordinating Authority to coordinate and deconflict deliberate 

nnission scheduling for unattached, co-located CMF (Cont.) 

• P7 OPS-SYNC: IT 7.1, IT 7.2 Deconflict and synchronize Operations with the 1C and 
adjacent units (Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower) 

6.5 Serve as the USCC Coordinating Authority to coordinate and deconflict time sensitive 

operations for unattached, co-located CMF, Ops Sync 

• P3 



• P7 OPS-SYNC: IT 7.1, IT 7.2 Deconflict and synchronize CO with the 1C and 
adjacent units (Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower) 

6.6 Prioritize Architecture and Capabilities Development and Requirements (ISO Task 4) 

• IT 5.2 CMWG: Review and prioritize capability requirements; Deconflict 
Command/SCC requirements 
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JFHQ-C MET 6 and MCFs 


6.3 Serve as the USCC Coordinating Authority facilitating as required. Service Component 
ADCON through local coordination of admin, logistics & support requirements for all 
co-lo cated (attached and unattached) CMF 



• P4 Planning Teams: IT 4.1 Coordinate with USCC as required for administrative, 
logistic and operational support (Ref TA4 Perform Logistics and Combat Service 
Support, TA 4.2 Provide Sustainment) 

6.4 Serve as the USCC Coordinating Authority to coordinate and deconflict deliberate 
mission scheduling for unattached, co-located CMF 



P4 Planning Teams: IT 4.2 Submit JTCRs to add CO missions to the MCOP and ITO 
(Ref TA 5.6.5.1 Coordinate Employment of Cyberspace Operations) 
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6.1 Plan, Direct, and Execute Exercises (Cont.) 

• P6 Joint Targeting Cycle: 

IT 6.1 TDWG: Develop targets through the intermediate stage and vet them 


with the 1C 

IT 6.2 JTWG: Nominate and approve entities of interest for target 
development, and conduct advanced target development of vetted targets 
IT 6.3 Build cyberspace strike package to present at JTCM & JTCB 

IT 6.4 JTCB: Approve the target and cyberspace strike package for tactical 
engagement and place on JIPTL 


6.2 Provide Resource Management 
• PI Cyberspace Tasking Cycle: 

IT 1.3 Deconflict infrastructure/Assets (Ref TA 5.6.5.1 Coordinate 


Employment on CO) 

IT 1.5 Establish SPINs and TTPs to protect tradecraft and capabilities ( Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 



• IT 5.2 CMWG: Develop intelligence guidance and priorities for ISR forces 
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6.1 Plan, Direct, and Execute Exercises (Cent.) 

• PI Cyberspace Tasking Cycle: Plan, execute, and assess CO (Ref OP 4.4.5 Train 
Joint Forces and Personnel, OP 5.4.6 Conduct Operational Rehearsals)_ 



P7 OPS-SYNC: 


IT 7.1, IT 7.2 Deconflict and synchronize CO with the 1C and adjacent units 
(Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.5.1 Conduct Force Link up) 

IT 7.3 Identify cyberspace activity as neutral, friendly, or adversarial (Ref TA 
6,5 Provide for Combat Identification) 

IT 7.3 Disseminate I&W and operational assessment information (Ref TA 2.4 
Disseminate Tactical Warning Information and Attack Assessments) 
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• Coordinate JFHQ-C support functions for attached and for co-located CMF with 
USCC, NSA, service and functional components; direct CMF training, exercises, 
and readiness requirements. 

• Mission Critical Functions (MCF); 

6.1 Plan, Direct, and Execute Exercises 

• P4 Planning Teams: 

IT 4.1 Use intelligence reports to shape operational plans (Ref TA 2 Share 
Intelligence) 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

IT 4.2 Establish SPINs and TTPs to protect tradecraft and capabilities (Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 

• P5 Operational Priorities and Intelligence Collection Priorities: 

IT 5.1PWG: Analyze demand signal from CERFs and command guidance 
against current and operational planning priorities 

IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 
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JFHQ-C MET 5 and MCFs (Cont.) 

5.12 Conduct Intelligence Staff Operations 

• PI Cyberspace Tasking Cycle: Iterative, Cyclic process that allows intelligence staff 
officers to incorporate intelligence into plans and operations 

• P5 Operational Priorities and Intelligence Collection Priorities: 

IT 5.1 PWG: Analyze dennand signal from CERFs and command guidance 
against current and operational planning priorities 
IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 
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S.llProduce operational Intelligence 

• PI Cyberspace Tasking Cycle: Plan, execute, and assess Cyberspace ISR {Ref TA 
1.2.5 Conduct Site Exploration) 



P4 Planning Teams: 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

IT 4.2 Establish SPINS and TTPs to protect tradecraft and capabilities (Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 

IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 


• P7 OPS-SYNC: IT 7.3 Disseminate operational assessment information (Ref TA 2 
Share Intelligence) 
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^ JFHQ-C MET 5 and MCFs (Cont.) 

5.10 Provide SIGINT on Specified Targets 

• PI Cyberspace Tasking Cycle: Plan, execute and assess Cyberspace ISR (Ref TA 
1.2.5 Conduct Site Exploration)_ 


• P4 Planning Teams: 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

IT 4.2 Establish SPINs and TTPs to protect tradecraft and capabilities ( Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 

• IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 
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JFHQ-C MET 5 and MCFs (Cent.) 


5.9 


Conduct Single Source Exploitation 

• PI Cyberspace Tasking Cycle: Plan and conduct Cyberspace ISR (Ref OP 5.6.5.4 
Conduct Computer Network Exploitation (CNE) Enabling Operations) 



P4 Planning Teams: 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

IT 4.2 Establish SPINs and TTPs to protect tradecraft and capabilities ( Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 

P7 OPS-SYNC: 


IT 7.1, IT 7.2 Deconflict and synchronize CO with the 1C and adjacent units 
(Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.5.1 Conduct Force Link up) 

IT 7.3 Disseminate l&W and operational assessments (Ref TA 2.4 Disseminate 
Tactical Warning Information and Attack Assessments) 
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JFHQ-C MET 5 and MCFs (Cont.) 

5.8 Conduct Cyberspace ISR (Cont.) 

• PI Cyberspace Tasking Cycle: 

IT 1.5 Conduct Cyberspace ISR (Ref OP 5.6.5.4 Conduct Computer Network 
Exploitation (CNE) Enabling Operations) 

• P7 OPS-SYNC: 

IT 7 . 1 , IT 7.2 Deconflict and synchronize CO with the 1C and adjacent units 
(Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 7.3 Identify cyberspace activity as neutral, friendly, or adversarial (Ref TA 
6.5 Provide for Combat Identification) 

IT 7.3 Disseminate l&W and operational assessments (Ref TA 2.4 Disseminate 
Tactical Warning Information and Attack Assessments) 
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JFHQ-C MET 5 and MCFs (Cont.) 

5.7 Develop Operational Targets (Cont.) 

• P4 Planning Teanns: IT 4.1 Conduct target system analysis on adversarial networks 
(Ref TA 2.3 Produce Imagery Target Graphics) 

- P6 Joint Targeting Cycle: 

IT 6.1 TDWG: Develop targets through the intermediate stage and vet them 
with the 1C 

IT 6.2 JTWG: Nominate and approve entities of interest for target 
development and conduct advanced target development of vetted targets 

IT 6.4 JTCM: Deconflict targets with the 1C and Joint forces and coordinate 
cyberspace strike package 

IT 6.4 JTCB: Approve the target for tactical engagement and place on JIPTL 

5.8 Conduct Cyberspace ISR 

• P3 


. p4 


IT 4.2 Establish SPINs and TTPs to protect tradecraft and capabilities ( Ref TA 

6.8 Conduct Defensive Countermeasure Operations) 


(bK3)10U.S.C.§ 130e 


Planning Teams: 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 
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5.6 Provide Intelligence Support to Plans, Operations, and Fires 

• PI Cyberspace Tasking Cycle: Iterative, Cyclic process that allows intelligence 
integration into the planning and execution of CO 

• P4 Planning Teams: 

IT 4.1 Use intelligence reports to shape operational plans (TA 2 Share 
Intelligence) 

IT 4.1 Conduct target system analysis on adversarial networks (Ref TA 2.3 
Produce Imagery Target Graphics) 

IT 4.2 Digest MISREPs and intelligence reports and produce effects and 
tactical assessments (Ref OP 2.8.1 Provide Intelligence Support to Fires, OP 
2.8.4 Provide Intelligence Support to Combat Assessments) 

• P7 OPS-SYNC: IT 7.3 Disseminate l&W and operational assessments (Ref TA 2.4 
Disseminate Tactical Warning Information and Attack Assessments) 
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JFHQ-C MET 5 and MCFs (Cent.) 

5.4 Conduct Intelligence Preparation of the Battlefield (IPB) 

• PI Cyberspace Tasking Cycle: Plan and conduct Cyberspace ISR (Ref TA 1.2.5 
Conduct Site Exploration) 

• P4 Planning Teams: IT 4.1 Conduct target system analysis on adversary networks 
(Ref TA 2.3 Produce Imagery Target Graphics) 

5.5 Gain & Maintain Situational Understanding 

• PI Cyberspace Tasking Cycle; Plan, execute and assess Cyberspace ISR (Ref OP 
5.6.5.4 Conduct Computer Network Exploitation (CNE) Enabling Operations) 


P3 

(b)(3) 10 U.S.C.§130e 

;b)(3)10U.S.C.§130e 



• P4 Planning Teams: IT 4.1 Use intelligence reports to shape operational plans (Ref 
TA 2 Share Intelligence) 

• P7 0PS-SYNC: 


IT 7.1 Deconflict and synchronize CO with the 1C and adjacent units (Ref TA 
3.3 Coordinate Battlespace Maneuver and Integrate with Firepower, TA 
5.5.1 Conduct Force Link up) 

IT 7.2 Synchronize CO with other lethal/non-lethal operations (Ref 3.3 
Coordinate Battlespace Maneuver and Integrate with Firepower) 

IT 7.3 Identify cyberspace activity as neutral, friendly, or adversarial (Ref TA 

6.5 Provide for Combat Identification) 

IT 7.3 Disseminate l&W and operational assessments (Ref TA 2.4 Disseminate 
Tactical Warning Information and Attack Assessments) 
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5.2 Direct Joint Intelligence Support Element (JISE) operations (Cont.) 

• P7 OPS-SYNC: IT 7.1, IT 7.2 Synchronize and deconflict operations with the 1C and 
adjacent units (Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.6.5.1 Coordinate Employment of CNO) 

5.3 Perform Collection Management (Planning & Prioritization, Requirements 


Management, & Tasking Cyber ISR Assets) 

• PI Cyberspace Tasking Cycle: IT 1.3 Allocation (Ref Op 3.1.2 Apportion Fires) 



• P4 Planning Teams: 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

IT 4.2 Establish SPINs and TTPs to protect tradecraft and capabilities ( Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 

• IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 

• P7 OPS-SYNC: IT 7.1, IT 7.2 Synchronize and deconflict operations with the 1C and 
adjacent units (Ref TA 3.3 Coordinate Battlespace Maneuver and Integrate with 
Firepower, TA 5.6.5.1 Coordinate Employment of CNO) 


UNCLASSIFtED //F OR - O FFI C I AL USE ONLY 


63 










UNCLASSIFIED / /FOR OFF I C I AL US E ONLY 



JFHQ-C MET 5 and MCFs 


• MET 5; Conduct intelligence operations; including managing CMF intelligence 
requirements and the collection, production, and dissemination of intelligence. 

• Mission Critical Functions (MCF): 

5.1 Process and exploit collected operational information 

• PI Cyberspace Tasking Cycle: Iterative, Cyclic process \A/here intelligence drives 
operations 

• P4 Planning Teams: IT 4.1 Use intelligence reports to shape operational plans (TA 
2 Share Intelligence) 

5.2 Direct 

• PI 

• P3 


• P4 

IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

IT 4.2 Establish SPINs and TTPs to protect tradecraft and capabilities ( Ref TA 
6.8 Conduct Defensive Countermeasure Operations) 

• IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces 


Joint Intelligence Support Element (JISE) operations 

Cyberspace Tasking Cycle: IT 1.3 Allocation (Ref Op 3.1.2 Apportion Fires) 

!bK3)10U.S.C. §130e --- 


Planning Teams: 
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4.8 Coordinate with cryptologic enterprise elements (NSA) 

• P4 Planning Teams: 

IT 4.1 Conduct planning lAW the Joint Operation Planning Process (JOPP) 
outlined in JP 5-0 and coordinate with NSA as required to deconflict plans 
IT 4.1 Establish primacy on cyberspace assets/devices (Ref TA 6.5 Provide for 
Combat Identification) 

• P6 Joint Targeting Cycle: 

IT 6.1 Develop targets and Vet them with the Interagency lAW CJCSI 3370.01 
IT 6.4 Validate targets and cyberspace strike package at the JTCB lAW CJCSI 
3370.01 
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6.11 Conduct comnnand designated coordination operations 

• PI Cyberspace Tasking Cycle: Outlines B2C2WGs necessary to ensure proper 
coordination and integration with 1C and adjacent/higher units 

• IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces, and Deconflict Command/SCC requirennents 

• P6 Joint Targeting Cycle: 

IT 6.1 TDWG: Develop targets through the intermediate stage and vet them 
with the 1C 

IT 6.2 JTWG: Nominate and approve entities of interest for target 
development, and conduct advanced target development of vetted targets 

IT 6.3 Build cyberspace strike package to present at JTCM & JTCB 

IT 6.4 JTCB: Approve the target and cyberspace strike package for tactical 
engagement and place on JIPTL 
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6.12 Coordinate and direct weapon capability development 

• P4 Planning Teams: 

IT 4.1 Conduct target system analysis on adversarial networks (Ref TA 2.3 
Produce Imagery Target Graphics) 

IT 4.1; IT 4.2 Identify capability requirements and submit them for 
prioritization and development 
IT 4.2 Conduct advanced target development (Weaponeering) 

• IT 5.2 CMWG: Develop intelligence collection guidance and priorities for ISR 
forces, and Deconflict Command/SCC requirements 
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m Way Ahead 

• Staff lOC/FOC Certification Framework with Service Cyber Components 

• Conduct Troops to Task analysis 

• Either modify existing tactical actions contained in the UJTL to reflect CO or 
submit new TA for inclusion in the UJTL 

• Develop individual "Joint Qualification Requirements" 

• Feasibility of Support considerations • 

|{bK3)10U.S.C. § 130e 

- Workstations 

- Training support 

- Mininnum systems & security requirements 
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Terms of Reference 

• Blowback - Assesses the potential risk of retribution fronn the target(s) if the 
operation is detected and attributed to USCYBERCOM; assesses the vulnerability 
of the GIG to potential cyber retribution 

• Boards, Bureaus, Centers, Cells, and Working Groups (B2C2WG) - Staff functions 
for planning, coordinating, and prioritizing operations 

• Capability Target Pairing (CTP) - CTP is a report required for the ELA waiver and 
ensures proper Operational Testing and Evaluation (OT&E) 

• Cyberspace ISR - "Cyberspace ISR includes ISR activities in cyberspace conducted 
to gather intelligence from target and adversary systems that may be required to 
support future operations, including OCO or DCO" (JP 3-12) 

• Cyberspace Effects Request Form (CERF) - The CERF is a format used to request 
operational support in the cyberspace domain 

1(b)(3) 10 U.S.C. § 130e ' '-----1 


• Collateral Effects Estimate (CEE) - Estimates the collateral effects of each 
target/capability pairing; first order effects on unintended targets involved with 
the operation are evaluated using the CEE logic 
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Terms of Reference (Cont.) 


• Cyberspace Operations Directive (CyOD) - The CyOD focuses command activities 
on operational priorities across all three Lines of Operation (LOO), including 
DGO, DCO, and OCO and the Cyber Collection Guide (CCG) for the Operations 
Directorate 

• Cyberspace Operational Preparation of the Environment (OPE) - OPE consists of 
the non-intelligence enabling activities conducted to plan and prepare for 
potential follow-on military operations 

• Cyberspace Strike Package - The cyberspace strike package is the primary 
product presented to the chairman of the JTCB for the purpose of informing the 
Commander's decision regarding the execution of an operation 

• Defensive Cyberspace Operations - Response Actions (DCO-RA) - Deliberate, 
authorized defensive measures or activities taken outside of the defended 
network to protect and defend DoD cyberspace capabilities or other designated 
systems 

• Evaluated Level of Assurance (ELA) - Established technical assurance levels that 
define criteria for OCO Technical Assurance Standards (TAS) evaluations (DoDI 
3600.02) 
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Terms of Reference (Cont.) 


• Integrated Tasking Order (ITO) — Articulates the taskings for Joint CO for a 24 
hour period 

• Intelligence Gain Loss (IGL) - Indentifies the intelligence gain and loss associated 
with target(s) and planned effects; Probability of Detection (PoD) and Probability 
of Attribution (PoA) are evaluated with regards to the operation and capability; 
Perceived PoA/PoD is also evaluated. 

• Joint Collection Management Board (JCMB) - FO/GO decision board to review 
command priorities and discuss intelligence collection, access, and capability 
requirements; provide collection guidance, priorities, and direction for the 
employment of cyber forces; communicate prioritized requirements and 
synchronize collection actions supporting command planning and operations. 
The JCMB also identifies and prioritizes intelligence capacity and capability 
shortfalls. 

• Joint Tactical Cyber Request (JTCR) - Specifies the timing and tempo of activities 
conducted in and through cyberspace to achieve the supported commander's 
objective(s) 
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Terms of Reference (Cont.) 


• Master Cyber Operations Plan (MCOP) - The time-phased cyberspace operations 
scheme of maneuver for a minimum 72 hour period that synthesizes 
commander's guidance, desired effects, supported component's schemes of 
maneuver, available resources, and friendly and enemy capabilities 

• No Foreign Policy Objection (NFPO) - Assesses the absence of any objections 
from the Department of State with relation to foreign policy 

• Political Military Assessment (PMA) - Assess the potential political and military 
response to perceived or actual attribution of the operation as characterized in 
the order and TAB C to Appendix 16 to Annex C to an Order (Concept of Fires) 

• Record of Fires - A comprehensive database of all executed cyberspace 
operations documentation (e.g. ITOs, MISREPs, MISUMs) 

• Risk Assessment Report (RAR) - Assesses the risk associated with the design and 
operation of a particular capability 

• Sub-elements-Those formally recognized parts of a larger organization (e.g. 
combat plans is a sub-element of an Air Operations Center) 
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Example JQR (Cont.) 


TOP SECnCT// R fe- T0 USA. f Vi X 




JOB QUAUFICATION STANDARD (JQS) 



OFFENSIVE CYBER OPERATIONS (OCO) MISSION LEAD 





CERTIrICATtOM 



c 

7ASKSKNOWLEDGE 







Ml 

VI 

a 

A 

JOS; 

S 

1 


A 


6- 

flj 

1 — 

E 

n 

TECHNICAL REFERENCE 

m 

TJ 



5 ra 

Cerlifyln 

Official 

InhlDli 

C in 

V 01 

1 

c 

JC 

in 

e3 

O 

H 

1^ 

5 

OBJECTIVE; 

w 

ro 

O ! 

o 

O 

■« 'c 


D O 

L 

u 


o 

















USCVBEKCOM Jomi Optradoat C«ottr (l^O-LLl idth noted txcfpdoit) 

0PL15 

1 

2.0 


rtcoEiiait&4 auddocjisauu and pr^tdurK to 24X7,; 

epennoD SO OtDH USCC. 

1 fi 

TtL jis. JOC & OCO CONO? & iriK. 10 U.S.C. § 130e 

OBJ; QTTBD 

roc & OCO 

OJT 






la 

1 OPl^,? 

2,14 


Infoice iiromfltioa msnagtiiieu anl lecurity control', 

JQS; 1.1 j_ 

7K: J3S, JOC i OCOCOSOP&MTKj'^’Xai 10 U.S.C. § 130e qJ! 

OBJiQTIBD 






5b 

OPL2J 

1 

2.24 


Esubli^ ^eqmte coiorols to all OCO mf^nmrioa b3::«£ on principled a 

pnvilff e zid nji«l-t>kiicT:r lAW ConmiaDd cbdnfication fin tie;. 
jqS‘ L.LO 

TK; JJS. JOC & OCOCON'0.3 & 5rTK.!‘^K3) 10 U.S.C. § 130e 

OBJ; QT TBD - 

fl»:t 

OJT 






:b 

0F1.15 

1 

:.2M 


Evihntf cB&ctiv'ecedd of all IT plaifonnd for OC ^ ^ | C£KF, K2D2. J2T ? 

JOS: LI,1 

TR; JJS, IOC & OCO CONO? & ^mt. (‘^1(3) 10 'i■'^e§ 130e 

OBJ’OT TBD 

onaL> 

OJT 






:a 

OF 1.2.5 

2J9.0 


Escewe USCCJOC CoEMiun'ofOpeonoii; (COOP] Plat 

JQS: :.i.: ,_, 

TtL; JJS. JOC & OCO CONO? & irTK!b)(3) 10 U.S.C. § 130e 

OBJ: QT TBD - 

OJT 






4t 
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TOP sccncT// rcl to uea. rvcv 



Example JQR (Cont.) 


n 

o 


OPM5 

OPS. 1.2 
OPS 1.2 


opi .:.5 


OPl,2.5 


opl:,s 


OPM5 


OPL2.5 


OPL25 


OP 1 . 2.5 


4 


JOB QUAURCATtON STANDARD IJQS) 


S 


2.30 

5.0-0 

5.1.0 

5J.1 


2JJ.1 


2.4.0 


2.L0 


2.1 0 


2.1.0 


2.10 


2.1.0 


OFFENSIVE CYBER OPERA-TtOHS (OCO) MISSION LEAD 


T A K G/K NO/V U E OO L 

sJari‘ 

TEGHNICAl^ RfzFI^KENCI^- 
OfUeCTIVEf 


Cnrrfiil OlT^tt^siTc Cyb<r OptrsitioiL^(2.0-2^*€'3 vrith no-led. eiceptioo.*) 


CERTiPJCATlON 






Genwate, loute 2cii maintain SA on aU OCO oida:: coming mto or ient from 
U5CA■BERCO^^ (FRAGOS, OPORDS. EXOSDS) 

IQS: 2.0 


TR; m. ;OC A OCO CONOP A NrrRj(b)(3) 10 U.S.C, § 130e 
OBJ: QT TBD ' - 


OJT 


Make lecotumendanon: to tte C\'t«r Battle Captam cn OPR for CERf entiiK. {i.«. ■ tVnn 

lS0 = Jj:- than ISOJJi) 

JQS;2.1 


TR Jis. joc A OCO coN'op A 
OBI: QT TBD 


orr 


Geowate and ApptOMe Daiiv SPINS that accoaoinv ITO 
JQS- 


TR; JJS. JOC A OCO CONOP A MTRjt^X^) 10 U.S.C, § 130e 
OBJ: OTTBD 


OJT 


Maintain Situational ,\tvnrenei! and Manage IT platformt for the JOC A OCO 

CERT. R;D;. jitP onalJ 


JQS: 2^ ,_ 

TR: J3S. JOC vA OCOCONOP AMTRf^)<^^ 

OBJ: QTTBD 


orr 


Mainrain Situational Awaiene;; and Manate USCYBERCOMMAKD JOC Pofta! 
JOS: 2.3.0 


TR: ’J3S. JOC A OCO CONOP A .MTR|'=)(^> 
OBJr OTTBD 


OJT 


JQS: 2.3,1 - 


TR: BS. JOC OCO CONOP .t' 5rFRjC^K3) 10 U.S.C. § 130e 
OBJ: QT TBD - 


orr 


Maintain Sifttatiotial A’c^irene^; and Manage the Cvter Effects Request Fom (CERF)POTtai 

JQS: 2 3.2 


TR: JSS. JOC Sc OCO CONOP & MTRj(b)(3) 10 U.S.C. § 130e 
OBJ; QT TBD ^- 


OJT 


Maintain Situatianal Awareness foi the Operational Ehta Anal^-^n Tool {ODAT> 

JQS: 2.3 3 


TR JS$. JOC 3c OCO CONOP & MTft :b](3) 10 U.SC. § 130e 
OBJ: OTTBD ^— - 


OJT 


0 “ 


* - 
CJ 


'0 


5c 


3b 


3c 


3b 


3c 


4d 


4c 


:b 
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Example JQR (Cont.) 


TOP SECRET//REL TO 4 JSA> FVEY 


^08 QUALIRCATION 5TAHDARP 


OFFENSIVE CYBER OPERATIONS (OCO) MISSION LEAD 




(j 


if 


u 


T AS KSmNOTLEDGE 
JQS: 

TECHWICAL REFERENCE: 
OBJECTIVE: 


CERTIFICATION 








■S “s-as 

pT S 
o O 


& 

Cl 4A 

eo 

Q. 


OP12 5 


DPI 


:.i.o 


Mjmtam StfciaQoojJ AT^areims for tlw 621*OCR2D2 Portgil 

JQ3. 2,3.4 


2 I 0 


m-JJ3. joc*ocaco>'o? io u.so. § i30e 

OBJ: QT T 3D 


OJT 


\f 31 zsJ 3 tn Sitnjtwoi An.-»mac^ foe tl]>« C^-twrCanttTWxi Op»#itinf IHf-NttA (^C^^MtCOP) 

JQ5. 2JJ 


IK: Ji5. JOC Jt: OCO CONQP & MIKI^P) 10 U.S.C. § 130e 
OBr-QTTBD *- 


OJT 


th 


3K 


OPIJ2 5 


2T0 


ctiEh DCO, DCO S: NTDC IT pLitfeniiz sudi pfo4.%ts tiiat 

opia^Uyu^ 

JQS: 2 J.6 

..... OJT 


TR: J3S. JOC & OCO CONO? & 
OBI QT rap 


on 


1.0 


Exerute asd cn/frrec flrtailcd IO CXO PIad: aod aj:dtr~ And 

reqnlrfiiMiit'^ M la ^penifi^aii l«r4t, 

JQS: :.4 

■.. OJT 


TK: J3S, JOC & OCOCONOP &MTK.F^1(3) 10 U.S.C. § 130e 
OBJiQTTBD 


OPl 


1.0.0 


Act A^t JJ^ CEief in Jibmicc (AIipi^ vfiih tUe Cotaaa.*ajci‘a inttoi) 

JOS: 2*4.0 r- 

IK JiS* JOC & OCO CONOP Sc 
OBI' QT TBD 


UJT 


OPl 


1*0J 


Eof^rcc^ad Expiate tbe lotc^atcd Tii^lwiag Order 

JQS: r* 4 .l 


TtC m. JOC JtOCQCQNOPJtMTtCfbPJ 10 U.S.C. § 130e 
0BJ:0IIBI) 


orr 


Ic 


OPl 


1.22 


Ei&a rXO t9 uml;! Acd pgutDATi iESr aocutioa 

JQS, 2*4.1.0 


IX; JJ5, JOC- & OCO CO.NO.I* & MIK)tti)(3) 10 U.S.C. § 130e 
OBJ; 01 TBD 


OJT 


^ P- 5ECRET;7 R£L TO US/‘ r-P V£V 
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Example JQR (Cont.) 


TOP SECRET/'/REL TO USA, FVEY 


JOB OUALtFICATIOH gTAMDARD {JQ$) 


OFFENSIVE CYBER OPERATIONS (OCO) MISSION LEAD 


■s 

t— 

■1 

O 


0?31 2 


0?!.2S 


CPUJ 




o?l:.5 




0?1.15 


B 


O 


TASKSmr^OWLEDGe 

JQ5: 

TECHMfCAL REFERENCE: 
OBJECTi'/E: 


2,5.C 

5.01 


:j71 


2,7.1 


2.S,1 


2,170 


2.$ 


2,190 


acd .Nhrntah QA lutcpned Ta^ms Qiiti (IIO) 
IQS: 2.4.1.1 


IR: J3a. JOC & OCO COKOP Sc MTK.(t3)(3) 10 U.S.C. § t30e 
QBJiQTTBD ^- 


Direct po^t esecutiot rtportms of ITO actbus 

IQS: 2.41,2 


TR: J3S. JOC Sc OCOCOXOP Sc 10 U.S.C. § 130e 

OBJ: QT IBP 


A^:;e:3 ITO action:, accoidin; to indicanons and iiTnime; 

JQS:2.4.1J 


TR: J5S, JOC & OCO CONOP & ^0 U.S.C. § I30e 

OBJ: QT IBP ^-- 


Coortmate HO acticn; accading lo icdicaioni aryl wamim 

JQ$:2,4i.4 


TR: JiS, JOC Sc OCO CONOP Sc \JTR,tt')(3) 10 U.S.C. § 130e 

OBJiOTTBD --— 


Ectectte ITO actions accordtij to miicatioci and T^amm£: 

JQS: 2,41.5 


IR: J3S. JOC Sc OCO CONOP & ^^lUb)^3) 10 U.S.C. § 130e 
OBJ: QT IBP 


OJT 


OJT 


OJT 


OJT 


on 


Assist tbc JOC C*BC'm cetnmoo opera tioiLii picture (COP)* 

JQS:2.5 

TR: BS. JOC Sc OCO COXOP Jt ^^TRJ(b)(3) 10 U.S C, § 130e 

OBJ QTTBD ^- 


OJT 


Report to leadffl’ship ifConmander Critical Infonnition Reqmremint has been mtt and 
submit CCIRs TEvhen necessary’. 

JQS: 2,5,0 

TR; J33. JOC & OCO COXOP 5c MTRj(bK3) 10 U.S.C. § 130e ojx 

OBJ: QTTBD ^ 


CERTIFICATION 


5 

■c: 

m 

<n 




^ 
c ” 


E? ^ 


E — JS 


C 4A 

2 O 
fi- 


Si 


4< 


4c 


4f 




4< 


9S 
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Example JQR (Cont.) 


TOP-SCCTCT// na to USA; . rv£Y 


JOB QUAlinCATION STANDARD (JQS) 


OFFENSIVE CYBER OPERATIONS (OCO) MISSION LEAD 


I 

o 


E 


TASKS/KKOV/LEOGE 

JQS: 

TECHNICAL REFEREraCE: 
O&JECTIVE: 


CERTIFICATION 


St 

"Jn 


o 

O 


^ ja 
4p a 
S « 


w fn 

•5^ 

e = 


^ iO 

5 o“ 


& 

IB 

go 

CL 


OFiJO 




^ubDUi or respond 70 re<^e:t^ for de*coQliictioa otLSO opei^non:. 

JOS: 2,11 c--- 

TR: JJ8. JOC & OCO COKOP .Se ,\rrRf b)(3) 10 U.S.C. § 130e 

OBJ: OT TBD 


OJT 


:b 


OPl 2 5 


in 


Initiate BneT^ and ReDorr^ on adv^er^Jiul and fiieodlv situations 


TR: J3S. JOC & OCO COKOP k ^ 

OBJ: QT TBD 


OJT 


Send SURE? from USc ICcJCLOM Iq tfa# JIATF that explatas post weeks 

CfTcaiixx CvVct Oj>cx3Uoci 

JQS: 2.5 i 


3c 


OPIJ5 


2.110 


TR: J3S. JOC & OCOCONOP & MTR.t^)t3) 10 U.SC. § 130e 
OBJ: QT TBD~ 


OJT 


OPl 13 


2T3.0 


Ho^t Ope, Sv-cchinciizaiioii Meetmz; mectmz de::tpi«d for all paitie: to ^>iichrom2e 
opeiatione 
JQS: 2.5-1 


TR: J3S. JOC Sz OCO CONOP Si .\rnij(b)(3) 10 U SC. § 130e 

OBJ: QT TBD— 


OJT 


OPl 


l; 


E^tablitb and mahiiaiii podrir# coDtrol of Cyber Forces, 
JQSr ZS-S- 


TR: J3S. JOC Jc OCOCONOP 5:MJRjfbK3) 10 U.S.C. § 130e 

UBJ:Ql IBP 


OJT 


3 c 


OPl 1.5 


211 


Maimin relatioad^: mtb USCC Diitctoote^ EJoD Coanpooeiu::,. lntelkf«ic€ A;esciee,, 

Es^rcescsi JJS isd parmcr oirpinimtiotts uri^h^d m c>4kt 

plane mg or odier related aiea^ 

JQS:2.5.5.0 


TR: J3S, JOC Jc OCO CONO? & .MTR (b)(3) 10 U.S.C. § 130e 
OBJ: OT TBD - 


OJT 


:b 


OPilJ 


2.21 


Coendmafe wiib USCC Direcrontee. DoD Componenc. larelligence Agencie::. Law 
Enforuemenr (LE). US OtneniEzicnr and partner or^am^anon^. 

JQS:2.5.5.l 


TR: J3 S. JOC & OCO CONO? Sc § 130e 

OBJ: OT TBD - 


on 
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Example JQR 


TOP SECnCT// nUL TOU5/\. F VEY 


JOB QUALIFICATION STANDARD (JQS) 


OFFENSIVE CYBER OPERATIONS (OCO) MISSION LEAD 


U 

E 


^1? 

<3 


TASKSACWOWLEDG E 
JQS: 

TECHNICAL REf ERENCE: 
OBJECTt^/E: 


CERTIFICATION 


o 


O 

O 


ifi 

^ Jd 

V CQ 


II 

e 1 


Oi irt 

ill 


Q 

IX 


OPl 


T>.0 

l.U 


Identify* the TACON and OPCON USCC CA-ber Foice Stmcmre and 

rebtioii^ihips. 


TK: J3S.JOC j;:OCOCONOP&MTR,t^H3) 1QU.SO.§ 130e 
QBJ: 01 IBU --- 


OJT 


3c 


OPl 


OPl 


3T.4 


Estiblish ALEK-TCON Stani; with USCC coutroUeJ vmit:, 

JQS^: 2.5.5. J _ 

IK; J3S. JOC *feOCOCONOP&MTIt.t^)t3) 10 U.S.G. § 130 g 
OBJ. QT TDD - 


OJT 


1.15 


KecomiD&nd Chanfe^ of ALERTCON Sfaru^ for USCC conftoU^d Snof mut;. 

JQS: 25-5.4 


TK: J3S. JOC Sz OCO COXO? Sc MTRjtb)(3) 10 U.S.C. § 130e 
OBTQTTBD 


OJT 


3c 


OPl 


OPl 


OPl 


OPl 


1 . 2-0 


Mai n ta i n Openrtiocal control duiiiit of finnE uniK during Title 50 and Tide 10 opeaation:^. 

JQS; 25-5.5 " __ 

TK: J3S, JOC Sz OCO CONOP Jt MTR. [bK3) 10 U.S.C. § 130e ojT 

OBJ: OT TBD -- 


Id 

15 


E^tnVli^h and tmininin operational eommunjcation% 

JQS: 2.5 6 


TK: J3S. JOC * OCO CONO? Jfe MTIC|(b)(3) 10 U.S.C. §T30e 
QBI:QT TBD 


OJT 


1.1.0 


Establi:!! and mainiam opei aiioiial couimumcaui;>ii:i with Suboidiaaid OF Cemei 

JQS: 2.5 6.0 

TIE J3S. JOC OCO COMO? SrTRjbKS) 10 U.S.C. § 130e 
QBJ: QT IBP ’- 


OJT 


l.Ll 

l.U 


and maintam op«ratioc.M e<^tn trawacatiosa nitk Firms U&it=. Ssrv'ifa C«mpcicicnt^ 

and COCOM CSE 
JOS:1.5.6J 


TX- J3S, JOC &OCO COMOP & MTRf^K^) 10 U.S.C. § 130e 
OBJ: QT TBD 


OJT 


3l> 


;b 
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TOP sncnET// nEL to usa, p vey 



Example JQR (Cont.) 


3 

o 


OPl 


OPl 




OP2.S 


OP1J5 


OPl s 


OPl.2,5 


B 


tA 

a 


1.12 


12.0 


3.4.1 


3.5.1 




220 


JOB QUAUFICATION STANDARD (JQS) 


OFFENSIVE CYBER OPERATFONS (OCO) MISSION LEAD 


TASKSrKNOWLEDGE 

JQS: 

TECHNICAL REFERENCE: 
OeJECTn/E; 


Initiate commncicitioiu witli uniu TACON to USCYBERCO^L 

JQS; 2.5.6.2 


Trl: J3S, JOC OCOCONOP 
OBJOTTBD 


OJT 


Tpiti?*? comimicicatiocs ^uboidinate commands OPCON to XJSCYBEK.COM, 

JQS: 2,5.63 


TK: J3S. JOC & OCO CON'OP S: MTK, 10 U.S.C, § 130e 

OBJ: QTIBD 


OJT 


CERTIFICATION 


iS 

(/> 


c 

o 

§■(§ 

o 

O 


y> 

Qj eo 

s :-a 

(9 c 


Tactics (5*0-34)0 irith noted errepaons) 


Execute and maintain deliberate, dynamic and /or crisis pbns TSP;TST. 

JQS: 3.0 


IK: J3S. JOC Si OCO CONOP& 10 U.SC. § I30e 

QBJ:QTTBD 


OJT 


Monitor indication:; and umnine:; UKT Intel trigfen to raippon TTO action;. 

JQS: 3.1 


TK: J3S JOC 4cOCO CONOPJc 10 U.S.C. § 130e 

OBJ; QTIBD 


OJT 


Thix>u^ the CSE, mahc :aire cunent day ; execution; ate m line with COCOM CDK'; 
obj«cti\'c:, 

JQS: 5.2 


TKi J3S, JOC & OCO CONO? & MIILp)(3) 10 U.S.C. § 130e 
OBJ: QTIBD 


OJT 


\t.'iint 3 in Sitiiatinnal of rtmwit thtmif haul the jloh* and prtpaiwl to 

support efi'ectw'B deli\^cry of Cyber nffect; Request Ptoce;; (CERF). 

JQS; 3.3 


TK: J5S. JOC Si OCO CONOR Si MTFLpK^IO U.SC. § 130e 
OBJ: QTTBD 


OJT 


Implement and eraluare a coune of actioii to addieis a declared sipniicant c>^er evtnt. 

JQS: 3.4 


TRi J3S. JOC Si OCO CONOR & MTK.(tr)(3) 10 U.S.C. § 130e 
OBJ: QTIBD 


on 


e B 


— T5 -S3 
m 

oO 


go 

CL 


3c 


2b 


3c 


3c 
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Example JQR (Cont.) 


TOP SECRET// HEL TO USA, FVHY 




OPl 


OPi.15 

OP3.L6 


OP 1.15 


OP3 


OPL15 


OP3 


E 


1J.6 


2 . 2.0 

2 , 6,0 
6. LI 


121 


43 


2 16 


4.4.0 


UOBOUAUFICA'nQW STAHDARD (MS) 


OFFENSIVE CYBER OPERATIONS COCO) MISSION LEAD 


TASKS/KNcrjVLEDGS 

JOS' 

TtCHNfCAL Kt»=EHENCe‘ 
QOJtCTlve 


Initiate Recall proce<lai«i m te^^poii^ to tSP TST, Ciisb Action, 

JQS; 3.5 __ 

TR: JJS, JOC &OCO CONOP & MTRibKS) 10 U.S.C. § 130e 
OBJ: QTTBD - - 


OJT 


Execute Pre-Apprcn^ed Actions (PAA's} at moment's nonce. 

JQS: 3 6 


TR; J5S. JOC 5r OCO CONOP MTR,)(b)(3) 10 U.S.O § 130e 
OBJ: OTTBD 


OJT 


Build out comcittnications plans an TSP'TST, cnsin action situations arise. 

JQS: 3.7 


m J3S, JOC Sc OCO CONOP & NfTK,N(3)10U.S.C.§130e 
OBJ: QT TBD -- 


OJT 


Oversee and Assist in opera tion.xl utilizanon and employment of vreapont and 

capabiUfies. 

JQS:3.S 


TR: J3S. JOC & OCO CONOP & MTR|(bK3) 10 U.S.C. § 130e 
OBJ: QT TBD 


OJT 


Mamtam ninelv SA of imminent or hostile adversaiial mtentioni or acti\'itie:>“to include 
adienartal intennons to ccHiduct conmulei DeVnofk attack (CNA)—wbicliniay impact the 
command's OCO mission, resources, or capabilities. 

JQS:3,S.O 


TR- J3S . JOC & OCO CONOP & inR, :b)(3) 10 U.S,C, § 130e 
OBJ: OT TBD - 


OJT 


M aintai n Stmationil Awareness of capabilities available for title 10 actions and what effects 

these capabilities can be paired to do. 

JQS:3 8 1 

TR J3S. JOC Sc OCO CONOP Sc MTRlbH3) 10 U.S.C. § 130e OJT 

OBJ: OT TBD --- 


CERTinCATlON 


r 


I" 

,E e 


■ ^ jO 




ff 

S O 

CL 


:b 


5b 


5b 


5c 
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Example JQR (Cont.) 


T Q P SCCr^ET// nCL TO USA; fVE - Y 


JOB QUALIFICATTOW STANDARP (JQS) 


OFFENSIVE CYBER OPERATIONS (OCO) MISSION LEAD 


►— 

1 

U 


if 

E 


Ti-\SKS/KNOWLEDCe 

JOG. 

TECHNICAL REFERENCE: 
OBJECTIVE: 


CEFaiFiCATlOPJ 


41 

m 




Q 

O 


II 

to c 


VI 

£ .3 


O' tA 
~ TS ^ 

3i^ 


eo 


D?3 


430 


Matctnuj ^UtauLtiOBjI TTPi CApablUlr iu elTcCU p>Jiiir.r^ 

JQb:iS.3 c- 

TR lis. jor .t OCO CONOP ,t XfTRPW) 10 U.S.C,§ 130e 
OBJ:OTTBD 


OTT 


OP3 


'oprrr 


4.1.0 


73S Plxc^ ud tir^nap braicbe: ni nr^t to tffecc 
IQS: 5 S > 


TJ?r 
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OBJ: OT TBD ‘-- 


OJT 


3 a 


OPl.2.5 


Putiopotc m. CQciaii^iad usd ptmuJc feedback \~u a£^ acuoei icport:. 

JQ3.3.91 


TR: BS. JOC k OCO CONOP4: MIX 10 U.S.C. § 130e 
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Example JQR (Cont.) 




JOB QUALIFICATION STANDARD (JQS) 



OFFENSIVE CYBER OPERATIONS <OC6) MISSION LEAD 





■■ 

certificatTon 

«A 

fO. 

1- 

1 

6 

H 

F 

CD 

1- 

¥ * 

■s 

ra 

1- 

41 

w 

o 

CJ 

TASKG/KNW/LEDGC 

JQS; 
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Example JQR (Cont.) 


JOB QUAURCATION STANDARD (JQS) 


OFFENSiVE CYBER OPERATIONS <OCO> MISSION LEAD 
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OP2 .'I 




1 3 1 


TAGKS/KNOWLEDGE 

JQS; 

T&CHNlCAi. HkFEHeNCb: 


As »*11 iMats tf Ttjtli a<>i#d 
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OBJ: OT TBD 


OJT 


OPJ,I*6 


OP3 l,b 


6.0 .Q 
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6 . 0.1 
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OJT 
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TR m. JOC OCO COKOP .5: MTRjCb)(3) 10 U.S C, § 130e 
nriT OT TBD 


OJT 


OP5 1 6 
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JQS 5 04 


TR m IOC S: OCO COVOP Si ^fTR^^t^K3) 10 U.S.C. § 130e 
OBJ: OT TBD 
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OJT 


QPJ.1.6 


OP.Tl 1 6 


6-1 .g 
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Example JQR (Cent.) 



CONDITION 

WJIM 

KEIEREIKE 

inoiviauai may reterence applicabletraminsrerereRces. 

WITHOUT 

REFERENCE 

Individual may not utilize treinme references. 

STANOARO 

WITH MINIMAL 

ERROR 

IndtviduGl may make minimat errors thax do noi aticrthc stated task 
objective. 

WtIHOUl 

ERROR 

N 0 error may be comm itted 



’TASK PERFORMANCE LEVELS 

1 

> 

Can do simple parts of the task. Needs to be held or shown how to do 
most of the task (EXTREMELY LIMITED) 

Can do most parts of the task. Needs help only on hardest parts. May not 
meet loatl dciiLandv foi speed oi accuracy. (PARTTLLY PROPICIENT) 

3 

Can do all parts of the task. Needs help only a spot check of completed 
woiL Mccis uhuinnnji load demands Ibi speed and accui acv. 
(COMPETENT) 

4 

C.in do the con^lcte lAsk quicklv and nccitratelv. Can tell or show others 
how to do the task (HIGHLY PROFICIENT) ‘ 

“TASK. KNOWLEDGE LEVELS 

a 

Can name parts, tools and simple facts about the task. 
(NOMENCLATURE) 

b 

Can deteiimce step*bv-step procedures for doins the task. 
(PROCEDURES) 

C 

Can explain wliv and when the task must be done and whv each step is 
needed. (OPEFL^TING PRINCIPLES) 

d 

Can predict, idcntil)', and resolve problems about the task. 

(.ADVANCED THEORY) 




*A task knowledge scale "STiIiie may be used alone or xnth a task perfoimauce scale to define a level of knowledge for a 

specific task. (Example: b and lb) 
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